permit-vlan vlan-id
Function
The permit-vlan vlan-id command enables the authorization VLAN verification function and specifies VLANs from which packets are allowed to pass through.
The undo permit-vlan vlan-id command deletes VLANs from which packets are allowed to pass through.
By default, the authorization VLAN verification function is disabled.
Format
permit-vlan vlan-id { vlan-id1 [ to vlan-id2 ] } &<1-10>
undo permit-vlan vlan-id { { vlan-id1 [ to vlan-id2 ] } &<1-10> | all }
Parameters
Parameter |
Description |
Value |
|---|---|---|
vlan-id1 [ to vlan-id2 ] |
Configures VLANs from which packets are allowed
to pass through.
If to vlan-id2 is not specified, only the VLAN specified by vlan-id1 is considered as the VLAN from which packets are allowed to pass through after being verified using the authorization VLAN verification function. You can specify a maximum of 10 VLAN ranges at a time. The entered VLAN ranges cannot overlap. |
|
all |
Deletes all VLANs from which packets are allowed to pass through. |
- |
Usage Guidelines
Usage Scenario
When VLAN-based remote authorization is performed using the RADIUS server, you can run this command to enable the authorization VLAN verification function to limit the effective scope of authorization VLANs for authorized users. The authorized users can obtain the network access permission of the authorization VLANs only after passing the verification; otherwise, the users can only access network resources using service VLANs.
When the authorization VLAN verification function is disabled, the authorization VLAN function takes effect for all authorized users.
Precautions
The authorization VLAN verification function takes effect only in scenarios where VLAN-based remote authorization is performed using the RADIUS server.
Example
# In the VAP profile named vap1, enable the authorization VLAN verification function and configure VLAN 101 as a VLAN from which packets are allowed to pass through.
<AC6605> system-view [AC6605] wlan [AC6605-wlan-view] vap-profile name vap1 [AC6605-wlan-vap-prof-vap1] permit-vlan vlan-id 101
